Employees in some of Australia's largest organisations are flouting cybersecurity policies and many are sending confidential documents through unsecured devices or personal email accounts – and it's not just junior employees who are guilty.

A study from document PDF firm Nitro says that there is now a major disconnect between employees and policies that IT managers put in place.

91% of Australian businesses with more than 500 employees mandate what devices workers can use, while 88% mandate the software.

However, 52% of employees, including managers and C-Suite executives, use personal devices for work, 38% send work-related documents through personal email and 10% save their communication or files on devices without password protection.

55% of managers, senior managers and C-Suite admit they work on personal devices, 40% send work emails and files through personal email and 10% save their communication or files on devices without password protection.

The research also pegs employee mistakes such as opening phishing emails and ransomware as the most likely security threat (40%), compared to just a 24% likelihood of hackers or fraudsters.

“In a world where data breaches are increasingly commonplace, there remains a disconnect between the security policies at Australia's largest enterprises and the real-world behaviours of employees. Security remains a top priority for CIOs and IT managers, but it requires a company-wide compliance culture to ensure procedures are followed,” comments Nitro APAC director Adam Nowiski.

Employees may resort to using personal devices because they don't have the right software installed on their work devices, according to 23% of respondents. 27% install unsanctioned software themselves.

“Our study revealed software standardisation is too often an overlooked tool in the CIOs kit bag for plugging potential data leaks and driving top-down culture change to an environment free of disparate solutions, inefficient processes and risky employee workarounds,” he adds.

The lack of standardisation in Australian enterprises means there are more productivity bottlenecks and potential risks. 29% of respondents send files to colleagues to action because they don't have the right software.

“A ‘shadow IT' environment of mismatched software and inconsistent product lifecycles makes it nearly impossible for IT managers to protect against security vulnerabilities,” Nowiski adds.

“Standardised environments allow IT managers to focus on protecting and optimising organisations' IT systems based on uniform versions of solutions.

The research also found that 86% of enterprises enforce strong password procedures such as complexity, rotation or two factor authentication.

One in ten respondents admit they have printed sensitive work documents without destroying the documents after use.